Summary
The remote web server contains a PHP application that is prone to directory traversal attacks.
Description :
4Images is installed on the remote system. It is an image gallery management system.
The installed application does not validate user-input passed in the 'template' variable of the 'index.php' file. This allows an attacker to execute directory traversal attacks and display the content of sensitive files on the system and possibly to execute arbitrary PHP code if he can write to local files through some other means.
Solution
Sanitize the 'index.php' file.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2006-0899 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities